5

CVE-2014-5298

FileUploadsFilter.php in X2Engine 4.1.7 and earlier, when running on case-insensitive file systems, allows remote attackers to bypass the upload blacklist and conduct unrestricted file upload attacks by uploading a file with an executable extension that contains uppercase letters, as demonstrated using a PHP program.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
X2engine ≫ X2engine Version <= 4.1.7
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3% 0.856
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://cert-portal.siemens.com/productcert/pdf/ssa-234763.pdf
http://karmainsecurity.com/KIS-2014-10
http://packetstormsecurity.com/files/128353/X2Engine-4.1.7-Unrestricted-File-Upload.html
http://seclists.org/fulldisclosure/2014/Sep/78
http://www.securityfocus.com/archive/1/533514/100/0/threaded
https://github.com/X2Engine/X2Engine/blob/master/CHANGELOG.md